Struct OIDCProvider

auth/oidc.go:138–189

}

type OIDCProvider struct {
	JWTConfigCommon
	ValidationKey           *string  `json:"validation_key,omitempty"`         // Client secret
	CallbackURL             *string  `json:"callback_url,omitempty"`           // Sync Gateway redirect URL.  Needs to be specified to handle load balancer endpoints?  Or can we lazy load on first client use, based on request
	Scope                   []string `json:"scope,omitempty"`                  // Scope sent for openid request
	IncludeAccessToken      bool     `json:"include_access,omitempty"`         // Whether the _oidc_callback response should include OP access token and associated fields (token_type, expires_in)
	DiscoveryURI            string   `json:"discovery_url,omitempty"`          // Non-standard discovery endpoints
	DisableConfigValidation bool     `json:"disable_cfg_validation,omitempty"` // Bypasses config validation based on the OIDC spec.  Required for some OPs that don't strictly adhere to spec (eg. Yahoo)

	// DisableCallbackState determines whether or not to maintain state between the "/_oidc" and
	// "/_oidc_callback" endpoints. The default value of DisableCallbackState is false, which means
	// state is maintained between auth request and the callback. It can be disabled through provider
	// configuration by setting property "disable_callback_state": true. Disabling callback state is
	// vulnerable to Cross-Site Request Forgery (CSRF, XSRF) and NOT recommended.
	DisableCallbackState bool `json:"disable_callback_state,omitempty"`

	// AllowUnsignedProviderTokens allows users to opt-in to accepting unsigned tokens from providers.
	AllowUnsignedProviderTokens bool `json:"allow_unsigned_provider_tokens"`

	// client represents client configurations to authenticate end-users
	// with an OpenID Connect provider. It must not be accessed directly,
	// use the accessor method GetClient() instead.
	client *OIDCClient

	// clientInitLock synchronises access to the GetClient() and ensures that
	// the OpenID Connect client only gets initialized exactly once when
	// the client has been successfully initialized.
	clientInitLock sync.Mutex

	// clientInit tracks whether the client has been successfully initialized or not
	clientInit base.AtomicBool

	// IsDefault indicates whether this OpenID Connect provider (the current
	// instance of OIDCProvider is explicitly specified as default provider
	// in providers configuration.
	IsDefault bool

	// Name represents the name of this OpenID Connect provider.
	Name string

	// terminator ensures termination of async goroutines for provider
	// metadata sync. Closed during DatabaseContext.close().
	terminator chan struct{}

	// metadata describes the configuration of an OpenID Connect Provider.
	metadata ProviderMetadata

	// InsecureSkipVerify determines whether the TLS certificate verification
	// should be disabled for this provider. TLS certificate verification is
	// enabled by default.
	InsecureSkipVerify bool
}

type OIDCProviderMap map[string]*OIDCProvider